CVE-2026-65927: Apache Tomcat Rewrite Valve Off-by-One Error

CVE-2026-65927 Overview

CVE-2026-65927 is an off-by-one error [CWE-193] in the Apache Tomcat rewrite valve. The [N] (next) flag restarts rewrite processing at the second rule rather than the first rule. Attackers can send crafted requests that trigger unintended rewrite behavior and exhaust server resources.

The flaw affects Apache Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life versions 8.5.0 through 8.5.100 are also affected, and other unsupported branches may be vulnerable.

Critical Impact
Remote unauthenticated attackers can send crafted HTTP requests that cause denial-of-service conditions when the rewrite valve is enabled with rules using the [N] flag.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.0.M1 through 9.0.120 (and EOL 8.5.0 through 8.5.100)

Discovery Timeline

2026-08-25 - CVE-2026-65927 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65927

Vulnerability Analysis

The Apache Tomcat rewrite valve provides URL rewriting functionality similar to mod_rewrite. Rules can include the [N] (next) flag, which instructs the valve to restart rule processing from the beginning after a match. Under CVE-2026-65927, the valve restarts processing at the second rule instead of the first rule.

This off-by-one indexing error changes rewrite semantics. Rules positioned first in the configuration are skipped on restart iterations. Attackers can craft requests that repeatedly trigger the [N] flag to produce processing loops or bypass early filtering rules that administrators rely on for access control or normalization.

The availability impact is the primary concern. Confidentiality and integrity are not directly affected, but skipped rules may include security-relevant transformations that administrators expect to run on every iteration.

Root Cause

The root cause is an off-by-one error [CWE-193] in the loop control logic that handles the [N] flag. When the flag triggers a restart, the rule iterator advances past the first rule instead of resetting to index zero. This is a boundary condition error in the rewrite valve's rule dispatch code.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to a Tomcat instance configured with a RewriteValve that uses the [N] flag. The malformed rewrite state can trigger denial-of-service conditions through excessive processing. No authentication or user interaction is required. Servers without the rewrite valve enabled, or without rules using [N], are not affected.

See the Apache Security Mailing List Thread and the OpenWall OSS-Security Discussion for technical details.

Detection Methods for CVE-2026-65927

Indicators of Compromise

Elevated CPU utilization on Tomcat worker threads correlated with requests matching URLs targeted by RewriteValve rules.
Repeated HTTP requests to endpoints governed by rewrite rules containing the [N] flag.
Unexpected access log entries where early rewrite rules appear bypassed compared to configured behavior.

Detection Strategies

Inventory Tomcat instances and check rewrite.config files for rules using the [N] flag combined with pattern matches on attacker-controllable paths.
Compare deployed Tomcat versions against the fixed releases 11.0.25, 10.1.58, and 9.0.121 using version banner probes or configuration management data.
Baseline normal rewrite valve processing time and alert on sustained deviations that indicate rule-loop behavior.

Monitoring Recommendations

Enable access and rewrite logging on Tomcat and forward events to a central log platform for correlation.
Monitor thread pool saturation, request queue depth, and JVM CPU metrics on Tomcat hosts exposed to untrusted networks.
Alert on anomalous request patterns targeting URLs handled by the rewrite valve, particularly high-rate requests from single sources.

How to Mitigate CVE-2026-65927

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121, which contain the fix for the off-by-one error.
Audit all rewrite.config files across Tomcat deployments and identify rules that use the [N] flag.
Restrict network exposure of Tomcat management and application ports to trusted sources until patches are applied.

Patch Information

The Apache Tomcat project has released fixed versions: 11.0.25, 10.1.58, and 9.0.121. Users on EOL branches such as 8.5.x should migrate to a supported branch, since no fixes will be issued for end-of-life releases. Refer to the Apache Security Mailing List Thread for the official announcement.

Workarounds

Disable the RewriteValve in server.xml if it is not required by the application.
Remove or rewrite rules that depend on the [N] flag until the patched version is deployed.
Place a reverse proxy such as Apache HTTPD or NGINX in front of Tomcat to handle URL rewriting outside the vulnerable component.

bash

# Verify Tomcat version after upgrade
$CATALINA_HOME/bin/version.sh

# Check for rewrite rules using the [N] flag
grep -rn '\[N' $CATALINA_BASE/conf/Catalina/*/rewrite.config